systemd: Support reload scripts
nixos/firewall: Don't allow traffic during reload
Merge pull request #4108 from wkennington/master.firewall

Firewall: Don't allow traffic during nixos-switch / reload